3 ms·
Is there a more security-oriented alternative to SSHFS, where the connecting client won't be given shell access on the server? I just want to share a directory
by effie 3y ago
Is there a more security-oriented alternative to SSHFS, where the connecting client won't be given shell access on the server? I just want to share a directory from server to an untrusted VM over network, and have VM mount it, not give the VM shell access to the server.
FTP is close to such a thing, but it is somewhat archaic, slow and not sure about its security.
- quoiquoi 3y agoIf the user account is only supposed to have file transfer capabilities/no shell access, add it a to a specific group e.g. `sftponly`, and only allow this group to use the `internal-sftp` command in `/etc/ssh/sshd_config` Match Group sftponly ForceCommand internal-sftp -l INFO -f LOCAL6 AllowTcpForwarding no AllowAgentForwarding no GatewayPorts no X11Forwarding no
- effie 3y agoThank you, this seems to prevent client getting shell on the server, while allowing it to make SSHFS mounts. I've put /usr/sbin/nologin into client's row in /etc/passwd on the server as well (/dev/null would break everything including SSHFS). Is there some way to specify that nothing except internal-sftp is allowed, as opposed to setting each option explicitly to "no"? The latter way seems error-prone, one is bound to miss some obscure option there. And I wonder why do you suggest using the LOCAL6 log facility? In sftp-server, the default is AUTH...